Ansible Permissions, ACLs and File Modes
File modes in YAML have a trap, and it is not quite where most guidance says it is. A leading zero is fine; omitting it is not, because YAML then reads a decimal number and the resulting permissions are nothing like what you wrote. This proves it three ways, then covers recursion, ACLs for what mode cannot express, and where SELinux would sit on a RHEL host.
Automating Administration Guide 35 of 45 Intermediate
- OSUbuntu 26.04 LTS
- ansible-core2.20.1
- Python3.14.4
- TimeAbout 16 min
- Reviewed23 August 2026
Written against the versions above. This lab is Ubuntu 26.04 and EX294 is a RHEL exam. the `file` and `ansible.posix.acl` modules are identical on both. The difference is mandatory access control: RHEL has SELinux and the `ansible.posix.selinux`, `seboolean` and `sefcontext` modules that go with it, while Ubuntu uses AppArmor and `ansible_facts['selinux']` reports disabled.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| ANS-CTL01 | 192.168.0.36 | Ubuntu 26.04 LTS | Ansible Control Node | 2 Core | 3 GB | 50 GB |
| ANS-A01 | 192.168.0.37 | Ubuntu 26.04 LTS | Managed Node (group: web) | 2 Core | 3 GB | 50 GB |
Before you start
- A control node configured as shown in the first step.
- The session installs
acl, creates/opt/permsand a usercarol, and removes both.
-
The configuration this guide assumes
-
The octal trap is not where you think
-
Owner, group and recursion
-
ACLs for what mode cannot express
-
What would be SELinux on RHEL